Sapphire Sleet compromised the Mastra npm ecosystem by taking over the `ehindero` maintainer account and injecting the malicious `easy-day-js` typosquat into more than 140 `mastra` and `@mastra` packages. The weaponized package ran a postinstall dropper that disabled TLS validation, contacted C2 infrastructure, downloaded a cross-platform Node.js tasking client, and established persistence on Windows, macOS, and Linux. On selected Windows hosts, the actor delivered a PowerShell backdoor, performed host and wallet-extension reconnaissance, added Defender exclusions, and installed a SYSTEM-level `scdev` service for boot persistence. Microsoft assesses the activity with high confidence as Sapphire Sleet, a North Korean actor focused on cryptocurrency, blockchain, venture capital, and other financial targets.